Merge nucleic/olive-jade-civet-rznt into dev

NucleicBroker/NucleicBroker.csproj

@@ -16,7 +16,10 @@
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(UseWslc)' == 'true'">
-    <TargetFramework>net9.0-windows10.0.26100.0</TargetFramework>
+    <!-- Windows SDK 19041, matching the package's own lib TFM
+         (lib/net8.0-windows10.0.19041.0/wslcsdkcs.dll). Targeting a higher SDK revision
+         (26100) only adds a targeting-pack requirement the package does not need. -->
+    <TargetFramework>net9.0-windows10.0.19041.0</TargetFramework>
     <DefineConstants>$(DefineConstants);USE_WSLC</DefineConstants>
   </PropertyGroup>
 
@@ -26,8 +29,10 @@
 
   <ItemGroup Condition="'$(UseWslc)' == 'true'">
     <!-- Version-pinned (docs/WINDOWS_PORT.md §15): bump deliberately per release, never
-         float — the API is preview and breaking changes must be absorbed behind IWslc. -->
-    <PackageReference Include="Microsoft.WSL.Containers" Version="[0.1.0-preview.1]" />
+         float — the API is preview and breaking changes must be absorbed behind IWslc.
+         2.9.3 is the ONLY version on nuget.org and it tracks WSL's own version scheme, not
+         a `0.1.0-preview.N` one; the invented pin this replaced could never have restored. -->
+    <PackageReference Include="Microsoft.WSL.Containers" Version="[2.9.3]" />
   </ItemGroup>
 
 </Project>

NucleicBroker/Wslc/WslcFacade.cs

@@ -4,10 +4,29 @@ using Microsoft.WSL.Containers;
 namespace NucleicBroker.Wslc;
 
 // The REAL Microsoft.WSL.Containers adapter (docs/WINDOWS_PORT.md §1.5, §3.2), compiled
-// only with -p:UseWslc=true on Windows. The API is public preview (GA fall 2026) and its
-// exact shapes are validated by the M1 wslc spike — every mapping below that spikes prove
-// wrong gets fixed HERE, never above the IWslc seam. Until M1 runs on real hardware, treat
-// this file as the best-effort transcription of the documented object model:
+// only with -p:UseWslc=true on Windows.
+//
+// !! KNOWN WRONG AS WRITTEN — DO NOT BUILD ON IT. !!
+//
+// M1 spike (a) has run (docs/WINDOWS_PORT.md §13.1) and the real API differs from this
+// transcription in roughly twenty places. Most are renames that belong exactly here and
+// nowhere else, which is what the IWslc seam is for: GetVersion not GetServiceVersion,
+// `new Session(settings)` + Start() not CreateOrOpen, MemorySizeInMB, HostName, ImageName,
+// CreateProcess-then-Start rather than RunProcess, DeleteContainerOption, a named Signal
+// enum, RegistryAuth as a string, ImageInfo.Name/.Sha256, and two separate output events
+// instead of one with a stderr flag.
+//
+// Three differences are NOT renames and need decisions before this file is finished:
+//   1. there is no container enumeration at all, so §2.3 broker reattach and the
+//      container.list RPC have no API behind them;
+//   2. there is no per-container statistics call, so container.stats must exec cgroup
+//      reads inside the container instead;
+//   3. there is no pty and no uid/gid on ProcessSettings, so §7's Terminal panel loses
+//      tty mode and exec wraps argv in setpriv/su (which §3.2 already anticipated).
+//
+// Read §13.1 before touching this file. Fixing it is the next step of item 5, and it is
+// now a fast loop: the package restores, so `dotnet build -p:UseWslc=true` compiles it.
+//
 //   WslcService (components) → Session (VM host, images) → Container → Process.
 public sealed class WslcFacade : IWslc
 {